Chaindrop Worm Infects Over 1,300 Npm Packages, Affecting Billions
WHO:
TechRadar - The worm is named ChainDrop and is based on a variant called Shai-Hulud.
Techmeme - Researchers are investigating the impact of the ChainDrop worm.
WHAT:
VentureBeat - An attacker took over the GitHub account of the developer maintaining Keyv, leading to the release of poisoned versions of Keyv and its sibling caching packages within hours.
VentureBeat - Security firm Aikido counted at least 868 compromised packages across 1,381 versions, with over two billion monthly installs, a total that is still climbing.
VentureBeat - JFrog traced the campaign across more than 400 packages and 1,700 poisoned versions.
TechRadar - The ChainDrop worm has infected over 1,300 npm packages.
Techmeme - The compromised npm packages include Keyv, Cacheable, and flat-cache.
Techmeme - The infected packages have a combined total of 2 billion monthly downloads.
WHERE:
Techmeme - The infections are occurring on the Node Package Manager (npm) registry.
WHEN:
Techmeme - The article does not specify a date for the infection but discusses the ongoing impact of the worm.
WHY:
VentureBeat - CrowdStrike found that cloud-conscious criminal activity rose 171% in the first half of 2026, with supply chain compromise being one of the paths feeding it.
Techmeme - The worm is described as self-propagating malware, indicating it spreads on its own.
HOW:
VentureBeat - The attacker pushed malicious files directly to the main branch of each repository controlled by the maintainer, which allowed npm to generate a legitimate provenance attestation for the poisoned release.
VentureBeat - The malware exfiltrated stolen secrets to public GitHub repositories tagged "Shai-Hulud: Here We Go Again," which is the signature of the campaign.
Techmeme - The method of infection involves compromising npm packages, although specific technical details are not provided.
(UPDATED August 5, 2026 18:28 UTC)
An attacker has taken control of the GitHub account of the developer maintaining Keyv, resulting in the rapid release of poisoned versions of Keyv and related caching packages. Security firm Aikido has identified at least 868 compromised packages across 1,381 versions, which have accumulated over two billion monthly installs, a number that continues to rise. This incident is part of a broader trend, as CrowdStrike reports a staggering 171% increase in cloud-related criminal activity in the first half of 2026, with supply chain compromises being a significant contributor.
--
(UPDATED August 5, 2026 13:43 UTC)
A new self-propagating malware known as the ChainDrop worm has infected over 1,300 npm packages, including popular ones like Keyv, Cacheable, and flat-cache, which collectively boast a staggering 2 billion monthly downloads. Researchers are currently investigating the impact of this worm, which is spreading through the Node Package Manager registry. While specific technical details about the infection method remain unclear, the ongoing situation highlights significant concerns for developers and users alike.